@lyrixx 

1. 3rd party lib or not, composer.lock MUST NOT be ignored. During Composer install, the dependencies of this library will be installed according to what has been prescribed in the lock file. Without the lock file, the developers of this lib has no control over what version of dependencies the end-users can ultimately install. Read up on https://github.com/thephpdeveloper/dflydev-markdown/commit/f4f7170e9b78ec5702747e91fb78cd7e2d1fa922

2. my composer is installed globally. I like to ignore them locally too. i can ignore all composer.phar by global ignorelist too. no problem with that.